Improper Control of Generation of Code in Twig Rendered Views in Shopware
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.
- Published
- Apr 17, 2023
- Updated
- Jun 17, 2026
- EPSS
- 2.1% · 81th percentile
- CWE
- CWE-184
Sign in to follow · You’ll be notified if a followed record enters KEV, gets an exploit or is updated.
Report tools
Action score
36
Monitor
Low priority for now.
- CVSS
- 35 / 40 · 8.8 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 1 / 30 · 2.1%
CISA SSVC decision
- Exploitation
- proof of concept
- Automatable
- no
- Technical impact
- total
Vulnrichment: CISA's decision-tree inputs.
CNA vs NVD score
- NVD
- 8.8
- CNA · STAR_Labs
- 8.8
- agree
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Affected systems
| Vendor | Product | CPE |
|---|---|---|
| shopware | shopware | cpe:2.3:a:shopware:shopware |
Affected versions
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- shopware shopware6.1.0 and later · up to 6.4.20.0 inclusive
- shopware shopware6.5.0.0
Versions reported by the vendor
Affected version ranges reported by the assigning authority (STAR_Labs). Independent of NVD's CPE analysis and usually ahead of it.
Shopware AG Shopware 6
- up to and including 6.4.20.0affected · semver
- 6.5.0.0-rc1 and later · up to and including 6.5.0.0-rc4affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Packagist | shopware/core | before 6.4.20.1 | 6.4.20.1 |
| Packagist | shopware/platform | before 6.4.20.1 | 6.4.20.1 |
Same product
shopware: all recordsOther highest-scoring records for the same primary product.
- CVE-2019-12799In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, w51Plan
- CVE-2016-3109The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.47Plan
- CVE-2021-37708Command injection in mail agent settings40Plan
- CVE-2024-42357Shopware vulnerable to blind SQL-injection in DAL aggregations39Monitor
- CVE-2024-42355Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag39Monitor
- CVE-2024-22406Blind SQL-injection in DAL aggregations in Shopware39Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Packagist:shopware/core | 6.4.20.1 | Package registry (OSV) |
| Packagist:shopware/platform | 6.4.20.1 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
- Ngo Wei Lin (@Creastery)STAR Labs SG Pte. Ltd. (@starlabs_sg)reporter
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
No nightly-computed relations.
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
Technical details
Attack conditions
- Anyone who can reach it over the internet can trigger it.
- A low-privileged account is enough.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- high · data can be read
- Integrity
- high · data or configuration can be modified
- Availability
- high · the service can be disrupted
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
Weakness class (CWE)
CWE-184 · Incomplete List of Disallowed InputsCVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
Attack patterns (CAPEC)
- Double EncodingCAPEC-120likelihood: Low · Medium
- Command DelimitersCAPEC-15likelihood: High · High
- Flash InjectionCAPEC-182likelihood: High · Medium
- Using Leading 'Ghost' Character Sequences to Bypass Input FiltersCAPEC-3likelihood: Medium · Medium
- Exploiting Multiple Input Interpretation LayersCAPEC-43likelihood: Medium · High
- Argument InjectionCAPEC-6likelihood: High · High
- Using Unicode Encoding to Bypass Validation LogicCAPEC-71likelihood: Medium · High
- User-Controlled FilenameCAPEC-73likelihood: High · High
ATT&CK techniques
—
Noroxi analysis
No Noroxi analysis for this record yet
We don't hand-write analysis for all 385,000+ vulnerabilities; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.
We use this product, ask for helpChange log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
- docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023
- github.com/shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8f
Vendor advisories and official records. Exploit/PoC links are deliberately left out.